CVE-2026-27606

9.8

CRITICAL CVSS 3.1

Rollup 4 has Arbitrary File Write via Path Traversal

Overview

Description

Rollup is a module bundler for JavaScript. Versions prior to 2.80.0, 3.30.0, and 4.59.0 of the Rollup module bundler (specifically v4.x and present in current source) is vulnerable to an Arbitrary File Write via Path Traversal. Insecure file name sanitization in the core engine allows an attacker to control output filenames (e.g., via CLI named inputs, manual chunk aliases, or malicious plugins) and use traversal sequences (`../`) to overwrite files anywhere on the host filesystem that the build process has permissions for. This can lead to persistent Remote Code Execution (RCE) by overwriting critical system or user configuration files. Versions 2.80.0, 3.30.0, and 4.59.0 contain a patch for the issue.

Details

INFO

Published Date :

Feb. 25, 2026, 3:16 a.m.

Last Modified :

July 15, 2026, 2:19 a.m.

Remotely Exploit :

Yes !

Source :

[email protected]

Impact

Affected Products

The following products are affected by CVE-2026-27606 vulnerability. Even if cvefeed.io is aware of the exact versions of the products that are affected, the information is not represented in the table below.

ID	Vendor	Product	Action
1	Rollupjs	rollup

: Total Affected Vendor : 1 | Products : 1

Scoring

CVSS Scores

The Common Vulnerability Scoring System is a standardized framework for assessing the severity of vulnerabilities in software and systems. We collect and displays CVSS scores from various sources for each CVE.

Version	Severity	Source
CVSS		134c704f-9b21-4f2e-91b3-4a467353bcc0
CVSS 3.1	CRITICAL	[email protected]
CVSS 3.1	CRITICAL	0b0ca135-0b70-47e7-9f44-1890c2a1c46c
CVSS 4.0	HIGH	[email protected]

Solution

Update Rollup to a patched version to fix arbitrary file write via path traversal.

Update Rollup to version 2.80.0 or later.
Update Rollup to version 3.30.0 or later.
Update Rollup to version 4.59.0 or later.

Public PoC/Exploit Available at Github

CVE-2026-27606 has a 10 public PoC/Exploit available at Github. Go to the Public Exploits tab to see the list.

References

References to Advisories, Solutions, and Tools

Here, you will find a curated list of external links that provide in-depth information, practical solutions, and valuable tools related to CVE-2026-27606.

URL	Resource
https://github.com/rollup/rollup/commit/c60770d7aaf750e512c1b2774989ea4596e660b2	Patch
https://github.com/rollup/rollup/commit/c8cf1f9c48c516285758c1e11f08a54f304fd44e	Patch
https://github.com/rollup/rollup/commit/d6dee5e99bb82aac0bee1df4ab9efbde455452c3	Patch
https://github.com/rollup/rollup/releases/tag/v2.80.0	Product
https://github.com/rollup/rollup/releases/tag/v3.30.0	Product
https://github.com/rollup/rollup/releases/tag/v4.59.0	Product
https://github.com/rollup/rollup/security/advisories/GHSA-mw96-cpmx-2vgc	Exploit Vendor Advisory
https://access.redhat.com/errata/RHSA-2026:10175
https://access.redhat.com/errata/RHSA-2026:13508
https://access.redhat.com/errata/RHSA-2026:13512
https://access.redhat.com/errata/RHSA-2026:13545
https://access.redhat.com/errata/RHSA-2026:5132
https://access.redhat.com/errata/RHSA-2026:5649
https://access.redhat.com/errata/RHSA-2026:5665
https://access.redhat.com/errata/RHSA-2026:6174
https://access.redhat.com/errata/RHSA-2026:6802
https://access.redhat.com/errata/RHSA-2026:8483
https://access.redhat.com/security/cve/CVE-2026-27606
https://bugzilla.redhat.com/show_bug.cgi?id=2442530
https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-27606.json

CWE - Common Weakness Enumeration

While CVE identifies specific instances of vulnerabilities, CWE categorizes the common flaws or weaknesses that can lead to vulnerabilities. CVE-2026-27606 is associated with the following CWEs:

CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Common Attack Pattern Enumeration and Classification (CAPEC)

Common Attack Pattern Enumeration and Classification (CAPEC) stores attack patterns, which are descriptions of the common attributes and approaches employed by adversaries to exploit the CVE-2026-27606 weaknesses.

CAPEC-64: Using Slashes and URL Encoding Combined to Bypass Validation Logic Using Slashes and URL Encoding Combined to Bypass Validation Logic CAPEC-76: Manipulating Web Input to File System Calls Manipulating Web Input to File System Calls CAPEC-78: Using Escaped Slashes in Alternate Encoding Using Escaped Slashes in Alternate Encoding CAPEC-79: Using Slashes in Alternate Encoding Using Slashes in Alternate Encoding CAPEC-126: Path Traversal Path Traversal

We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).

radeksh/vuln-today-jenkins-slack-lib

Jenkins shared library that scans npm and Composer lockfiles with the vuln.today API and posts deduplicated CVE alerts to Slack

Groovy

Updated: 1 week, 6 days ago

0 stars 0 fork 0 watcher

Born at : July 2, 2026, 9:09 p.m. This repo has been linked 4 different CVEs too.

rmutyaba/cloudbeaver

None

Java Shell Batchfile Dockerfile HTML JavaScript TypeScript CSS EJS MDX

Updated: 2 weeks, 2 days ago

0 stars 0 fork 0 watcher

Born at : June 30, 2026, 5:27 a.m. This repo has been linked 13 different CVEs too.

Rgraf228/Security-writeups

This is where I keep my write ups for my home lab.

Updated: 1 week, 1 day ago

0 stars 0 fork 0 watcher

Born at : June 23, 2026, 5:35 p.m. This repo has been linked 9 different CVEs too.

th3oleano/cloudbeaver

None

Java Shell Batchfile Dockerfile HTML JavaScript TypeScript CSS EJS SCSS

Updated: 3 months ago

0 stars 0 fork 0 watcher

Born at : April 10, 2026, 2:38 p.m. This repo has been linked 9 different CVEs too.

hermanjustino/stems

Stem Splitter

Shell Python HTML JavaScript TypeScript CSS Batchfile

Updated: 3 months, 1 week ago

0 stars 0 fork 0 watcher

Born at : April 2, 2026, 3:29 a.m. This repo has been linked 3 different CVEs too.

NoTKanye23/attack-of-clones-research1

Prototype pipeline for detecting vulnerable code clones in the Debian archive using patch-derived signatures and Debian CodeSearch.

Python

Updated: 1 month, 3 weeks ago

0 stars 0 fork 0 watcher

Born at : March 5, 2026, 9:58 p.m. This repo has been linked 4 different CVEs too.

Lev0n82/SecurePlaywrightMCP

Hardened Playwright MCP implementation with Podman rootless containers, 5-stage gatekeeping strategy, and enterprise security controls

Dockerfile JavaScript

Updated: 4 months, 1 week ago

0 stars 0 fork 0 watcher

Born at : Feb. 26, 2026, 9:29 p.m. This repo has been linked 3 different CVEs too.

able-wong/docx-markdown-utils

Utilities for converting between DOCX and Markdown formats

JavaScript TypeScript HTML

Updated: 1 month, 3 weeks ago

0 stars 0 fork 0 watcher

Born at : April 23, 2025, 3:50 a.m. This repo has been linked 5 different CVEs too.

huchukato/stemify-audio-splitter

🎵 AI-powered audio separation tool - Split any audio file into vocals, drums, bass, and other instruments using advanced machine learning. Built with React, Flask, and Facebook's Demucs v4 model.

ai audio-editor audio-processing audio-separation demucs flask machine-learning music machine-learning-projects music-composition react stem-separation

Python JavaScript HTML TypeScript CSS Shell Batchfile

Updated: 1 week, 6 days ago

15 stars 0 fork 0 watcher

Born at : Nov. 7, 2024, 11:21 p.m. This repo has been linked 3 different CVEs too.

dbeaver/cloudbeaver

Cloud Database Manager

webapp dbeaver databases database cloud-database-manager cloud

Batchfile Shell Java HTML JavaScript TypeScript CSS Dockerfile SCSS EJS

Updated: 1 month, 1 week ago

4931 stars 528 fork 528 watcher

Born at : April 9, 2020, 4:39 p.m. This repo has been linked 13 different CVEs too.

Results are limited to the first 15 repositories due to potential performance issues.

The following list is the news that have been mention CVE-2026-27606 vulnerability anywhere in the article.

Results are limited to the first 20 news articles due to potential performance issues.

The following table lists the changes that have been made to the CVE-2026-27606 vulnerability over time.

Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.

CVE Modified by 0b0ca135-0b70-47e7-9f44-1890c2a1c46c

Jul. 15, 2026

Action	Type	Old Value	New Value
Changed	Affected	[{'cpes': ['cpe:/a:redhat:ansible_automation_platform:2.5::el8', 'cpe:/a:redhat:ansible_automation_platform_developer:2.5::el8', 'cpe:/a:redhat:ansible_automation_platform_inside:2.5::el8'], 'vendor': 'Red Hat', 'product': 'Red Hat Ansible Automation Platform 2.5 for RHEL 8', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/a:redhat:ansible_automation_platform:2.5::el9', 'cpe:/a:redhat:ansible_automation_platform_developer:2.5::el9', 'cpe:/a:redhat:ansible_automation_platform_inside:2.5::el9'], 'vendor': 'Red Hat', 'product': 'Red Hat Ansible Automation Platform 2.5 for RHEL 9', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/a:redhat:ansible_automation_platform:2.6::el9', 'cpe:/a:redhat:ansible_automation_platform_developer:2.6::el9', 'cpe:/a:redhat:ansible_automation_platform_inside:2.6::el9'], 'vendor': 'Red Hat', 'product': 'Red Hat Ansible Automation Platform 2.6 for RHEL 9', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/a:redhat:ansible_automation_platform:2.6::el9'], 'vendor': 'Red Hat', 'product': 'Red Hat Ansible Automation Platform 2.6', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/a:redhat:rhdh:1.8::el9'], 'vendor': 'Red Hat', 'product': 'Red Hat Developer Hub 1.8', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/a:redhat:rhdh:1.9::el9'], 'vendor': 'Red Hat', 'product': 'Red Hat Developer Hub 1.9', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/a:redhat:openshift_devspaces:3.27::el9'], 'vendor': 'Red Hat', 'product': 'Red Hat OpenShift Dev Spaces 3.27', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/a:redhat:service_mesh:2.6::el8'], 'vendor': 'Red Hat', 'product': 'Red Hat OpenShift Service Mesh 2.6', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/a:redhat:quay:3.10::el8'], 'vendor': 'Red Hat', 'product': 'Red Hat Quay 3.10', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/a:redhat:trusted_artifact_signer:1.3::el9'], 'vendor': 'Red Hat', 'product': 'Red Hat Trusted Artifact Signer 1.3', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/a:redhat:openshift_pipelines:1'], 'vendor': 'Red Hat', 'product': 'OpenShift Pipelines', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/a:redhat:ansible_automation_platform:2'], 'vendor': 'Red Hat', 'product': 'Red Hat Ansible Automation Platform 2', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/a:redhat:podman_desktop:0'], 'vendor': 'Red Hat', 'product': 'Red Hat Build of Podman Desktop - Tech Preview', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/a:redhat:jboss_fuse:7'], 'vendor': 'Red Hat', 'product': 'Red Hat Fuse 7', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/a:redhat:openshift_distributed_tracing:3'], 'vendor': 'Red Hat', 'product': 'Red Hat OpenShift distributed tracing 3', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/a:redhat:red_hat_single_sign_on:7'], 'vendor': 'Red Hat', 'product': 'Red Hat Single Sign-On 7', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/a:redhat:ansible_portal:2'], 'vendor': 'Red Hat', 'product': 'Self-service automation portal 2', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/a:redhat:ansible_automation_platform:2.6::el10', 'cpe:/a:redhat:ansible_automation_platform_developer:2.6::el10'], 'vendor': 'Red Hat', 'product': 'Red Hat Ansible Automation Platform 2.6 for RHEL 10', 'defaultStatus': 'unaffected'}, {'cpes': ['cpe:/a:redhat:service_mesh:3'], 'vendor': 'Red Hat', 'product': 'OpenShift Service Mesh 3', 'defaultStatus': 'unaffected'}, {'cpes': ['cpe:/a:redhat:advanced_cluster_security:4'], 'vendor': 'Red Hat', 'product': 'Red Hat Advanced Cluster Security 4', 'defaultStatus': 'unaffected'}, {'cpes': ['cpe:/a:redhat:amq_broker:7'], 'vendor': 'Red Hat', 'product': 'Red Hat AMQ Broker 7', 'defaultStatus': 'unaffected'}, {'cpes': ['cpe:/a:redhat:optaplanner:::el6'], 'vendor': 'Red Hat', 'product': 'Red Hat build of OptaPlanner 8', 'defaultStatus': 'unaffected'}, {'cpes': ['cpe:/o:redhat:enterprise_linux:10'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux 10', 'defaultStatus': 'unaffected'}, {'cpes': ['cpe:/o:redhat:enterprise_linux:8'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux 8', 'defaultStatus': 'unaffected'}, {'cpes': ['cpe:/o:redhat:enterprise_linux:9'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux 9', 'defaultStatus': 'unaffected'}, {'cpes': ['cpe:/a:redhat:enterprise_linux_ai:3'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux AI (RHEL AI) 3', 'defaultStatus': 'unaffected'}, {'cpes': ['cpe:/a:redhat:jboss_enterprise_application_platform:8'], 'vendor': 'Red Hat', 'product': 'Red Hat JBoss Enterprise Application Platform 8', 'defaultStatus': 'unaffected'}, {'cpes': ['cpe:/a:redhat:jbosseapxp'], 'vendor': 'Red Hat', 'product': 'Red Hat JBoss Enterprise Application Platform Expansion Pack', 'defaultStatus': 'unaffected'}, {'cpes': ['cpe:/a:redhat:openshift:4'], 'vendor': 'Red Hat', 'product': 'Red Hat OpenShift Container Platform 4', 'defaultStatus': 'unaffected'}]	[{'cpes': ['cpe:/a:redhat:ansible_automation_platform:2.5::el8'], 'vendor': 'Red Hat', 'product': 'Red Hat Ansible Automation Platform 2.5 for RHEL 8', 'versions': [{'status': 'unaffected', 'version': '0:2.5.20260422-2.el8ap', 'lessThan': '', 'versionType': 'rpm'}], 'packageName': 'automation-gateway', 'collectionURL': 'https://access.redhat.com/downloads/content/package-browser/', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/a:redhat:ansible_automation_platform:2.5::el9'], 'vendor': 'Red Hat', 'product': 'Red Hat Ansible Automation Platform 2.5 for RHEL 9', 'versions': [{'status': 'unaffected', 'version': '0:2.5.20260422-2.el9ap', 'lessThan': '', 'versionType': 'rpm'}], 'packageName': 'automation-gateway', 'collectionURL': 'https://access.redhat.com/downloads/content/package-browser/', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/a:redhat:ansible_automation_platform:2.6::el9'], 'vendor': 'Red Hat', 'product': 'Red Hat Ansible Automation Platform 2.6 for RHEL 9', 'versions': [{'status': 'unaffected', 'version': '0:2.6.8-1.el9ap', 'lessThan': '', 'versionType': 'rpm'}], 'packageName': 'automation-platform-ui', 'collectionURL': 'https://access.redhat.com/downloads/content/package-browser/', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/a:redhat:ansible_automation_platform:2.6::el9'], 'vendor': 'Red Hat', 'product': 'Red Hat Ansible Automation Platform 2.6', 'versions': [{'status': 'unaffected', 'version': '1777311120', 'lessThan': '', 'versionType': 'rpm'}], 'packageName': 'ansible-automation-platform-26/gateway-rhel9', 'collectionURL': 'https://catalog.redhat.com/software/containers/', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/a:redhat:rhdh:1.8::el9'], 'vendor': 'Red Hat', 'product': 'Red Hat Developer Hub 1.8', 'versions': [{'status': 'unaffected', 'version': '1774545605', 'lessThan': '', 'versionType': 'rpm'}], 'packageName': 'rhdh/rhdh-hub-rhel9', 'collectionURL': 'https://catalog.redhat.com/software/containers/', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/a:redhat:rhdh:1.9::el9'], 'vendor': 'Red Hat', 'product': 'Red Hat Developer Hub 1.9', 'versions': [{'status': 'unaffected', 'version': '1775140647', 'lessThan': '', 'versionType': 'rpm'}], 'packageName': 'rhdh/rhdh-hub-rhel9', 'collectionURL': 'https://catalog.redhat.com/software/containers/', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/a:redhat:openshift_devspaces:3.27::el9'], 'vendor': 'Red Hat', 'product': 'Red Hat OpenShift Dev Spaces 3.27', 'versions': [{'status': 'unaffected', 'version': '1776718585', 'lessThan': '', 'versionType': 'rpm'}], 'packageName': 'devspaces/traefik-rhel9', 'collectionURL': 'https://catalog.redhat.com/software/containers/', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/a:redhat:service_mesh:2.6::el8'], 'vendor': 'Red Hat', 'product': 'Red Hat OpenShift Service Mesh 2.6', 'versions': [{'status': 'unaffected', 'version': '1773059917', 'lessThan': '', 'versionType': 'rpm'}, {'status': 'unaffected', 'version': '1776191302', 'lessThan': '', 'versionType': 'rpm'}], 'packageName': 'openshift-service-mesh/kiali-rhel8', 'collectionURL': 'https://catalog.redhat.com/software/containers/', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/a:redhat:quay:3.10::el8'], 'vendor': 'Red Hat', 'product': 'Red Hat Quay 3.10', 'versions': [{'status': 'unaffected', 'version': '1773971077', 'lessThan': '', 'versionType': 'rpm'}], 'packageName': 'quay/quay-rhel8', 'collectionURL': 'https://catalog.redhat.com/software/containers/', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/a:redhat:trusted_artifact_signer:1.3::el9'], 'vendor': 'Red Hat', 'product': 'Red Hat Trusted Artifact Signer 1.3', 'versions': [{'status': 'unaffected', 'version': '1773934794', 'lessThan': '*', 'versionType': 'rpm'}], 'packageName': 'rhtas/rhtas-console-ui-rhel9', 'collectionURL': 'https://catalog.redhat.com/software/containers/', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/a:redhat:openshift_pipelines:1'], 'vendor': 'Red Hat', 'product': 'OpenShift Pipelines', 'packageName': 'openshift-pipelines/pipelines-hub-api-rhel8', 'collectionURL': 'https://access.redhat.com/downloads/content/package-browser/', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/a:redhat:openshift_pipelines:1'], 'vendor': 'Red Hat', 'product': 'OpenShift Pipelines', 'packageName': 'openshift-pipelines/pipelines-hub-db-migration-rhel8', 'collectionURL': 'https://access.redhat.com/downloads/content/package-browser/', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/a:redhat:openshift_pipelines:1'], 'vendor': 'Red Hat', 'product': 'OpenShift Pipelines', 'packageName': 'openshift-pipelines/pipelines-hub-ui-rhel8', 'collectionURL': 'https://access.redhat.com/downloads/content/package-browser/', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/a:redhat:openshift_pipelines:1'], 'vendor': 'Red Hat', 'product': 'OpenShift Pipelines', 'packageName': 'openshift-pipelines/pipelines-hub-ui-rhel9', 'collectionURL': 'https://access.redhat.com/downloads/content/package-browser/', 'defaultStatus': 'unaffected'}, {'cpes': ['cpe:/a:redhat:service_mesh:3'], 'vendor': 'Red Hat', 'product': 'OpenShift Service Mesh 3', 'packageName': 'openshift-service-mesh/kiali-operator-bundle', 'collectionURL': 'https://access.redhat.com/downloads/content/package-browser/', 'defaultStatus': 'unaffected'}, {'cpes': ['cpe:/a:redhat:service_mesh:3'], 'vendor': 'Red Hat', 'product': 'OpenShift Service Mesh 3', 'packageName': 'openshift-service-mesh/kiali-rhel9', 'collectionURL': 'https://access.redhat.com/downloads/content/package-browser/', 'defaultStatus': 'unaffected'}, {'cpes': ['cpe:/a:redhat:service_mesh:3'], 'vendor': 'Red Hat', 'product': 'OpenShift Service Mesh 3', 'packageName': 'openshift-service-mesh/kiali-rhel9-operator', 'collectionURL': 'https://access.redhat.com/downloads/content/package-browser/', 'defaultStatus': 'unaffected'}, {'cpes': ['cpe:/a:redhat:advanced_cluster_security:4'], 'vendor': 'Red Hat', 'product': 'Red Hat Advanced Cluster Security 4', 'packageName': 'advanced-cluster-security/rhacs-main-rhel8', 'collectionURL': 'https://access.redhat.com/downloads/content/package-browser/', 'defaultStatus': 'unaffected'}, {'cpes': ['cpe:/a:redhat:amq_broker:7'], 'vendor': 'Red Hat', 'product': 'Red Hat AMQ Broker 7', 'packageName': 'org.jolokia-jolokia-parent', 'collectionURL': 'https://access.redhat.com/downloads/content/package-browser/', 'defaultStatus': 'unaffected'}, {'cpes': ['cpe:/a:redhat:ansible_automation_platform:2'], 'vendor': 'Red Hat', 'product': 'Red Hat Ansible Automation Platform 2', 'packageName': 'ansible-automation-platform-24/lightspeed-rhel8', 'collectionURL': 'https://access.redhat.com/downloads/content/package-browser/', 'defaultStatus': 'unaffected'}, {'cpes': ['cpe:/a:redhat:ansible_automation_platform:2'], 'vendor': 'Red Hat', 'product': 'Red Hat Ansible Automation Platform 2', 'packageName': 'ansible-automation-platform-25/lightspeed-rhel8', 'collectionURL': 'https://access.redhat.com/downloads/content/package-browser/', 'defaultStatus': 'unaffected'}, {'cpes': ['cpe:/a:redhat:ansible_automation_platform:2'], 'vendor': 'Red Hat', 'product': 'Red Hat Ansible Automation Platform 2', 'packageName': 'ansible-automation-platform-26/lightspeed-rhel9', 'collectionURL': 'https://access.redhat.com/downloads/content/package-browser/', 'defaultStatus': 'unaffected'}, {'cpes': ['cpe:/a:redhat:ansible_automation_platform:2'], 'vendor': 'Red Hat', 'product': 'Red Hat Ansible Automation Platform 2', 'packageName': 'ansible-on-clouds/aoc-azure-aap-installer-rhel9', 'collectionURL': 'https://access.redhat.com/downloads/content/package-browser/', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/a:redhat:ansible_automation_platform:2'], 'vendor': 'Red Hat', 'product': 'Red Hat Ansible Automation Platform 2', 'packageName': 'automation-controller', 'collectionURL': 'https://access.redhat.com/downloads/content/package-browser/', 'defaultStatus': 'unaffected'}, {'cpes': ['cpe:/a:redhat:ansible_automation_platform:2'], 'vendor': 'Red Hat', 'product': 'Red Hat Ansible Automation Platform 2', 'packageName': 'automation-eda-controller', 'collectionURL': 'https://access.redhat.com/downloads/content/package-browser/', 'defaultStatus': 'unaffected'}, {'cpes': ['cpe:/a:redhat:optaplanner:::el6'], 'vendor': 'Red Hat', 'product': 'Red Hat build of OptaPlanner 8', 'packageName': 'org.optaweb.vehiclerouting-optaweb-vehicle-routing', 'collectionURL': 'https://access.redhat.com/downloads/content/package-browser/', 'defaultStatus': 'unaffected'}, {'cpes': ['cpe:/a:redhat:podman_desktop:0'], 'vendor': 'Red Hat', 'product': 'Red Hat Build of Podman Desktop - Tech Preview', 'packageName': 'rhdesktop/rh-podman-desktop-ext-bootc-rhel10', 'collectionURL': 'https://access.redhat.com/downloads/content/package-browser/', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/a:redhat:podman_desktop:0'], 'vendor': 'Red Hat', 'product': 'Red Hat Build of Podman Desktop - Tech Preview', 'packageName': 'rhdesktop/rh-podman-desktop-ext-openshift-local-rhel10', 'collectionURL': 'https://access.redhat.com/downloads/content/package-browser/', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/a:redhat:podman_desktop:0'], 'vendor': 'Red Hat', 'product': 'Red Hat Build of Podman Desktop - Tech Preview', 'packageName': 'rhdesktop/rh-podman-desktop-ext-redhat-account-rhel10', 'collectionURL': 'https://access.redhat.com/downloads/content/package-browser/', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/a:redhat:podman_desktop:0'], 'vendor': 'Red Hat', 'product': 'Red Hat Build of Podman Desktop - Tech Preview', 'packageName': 'rhdesktop/rh-podman-desktop-ext-rhel-rhel10', 'collectionURL': 'https://access.redhat.com/downloads/content/package-browser/', 'defaultStatus': 'unaffected'}, {'cpes': ['cpe:/a:redhat:podman_desktop:0'], 'vendor': 'Red Hat', 'product': 'Red Hat Build of Podman Desktop - Tech Preview', 'packageName': 'rhdesktop/rh-podman-desktop-ext-sandbox-rhel10', 'collectionURL': 'https://access.redhat.com/downloads/content/package-browser/', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/o:redhat:enterprise_linux:10'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux 10', 'packageName': 'grafana', 'collectionURL': 'https://access.redhat.com/downloads/content/package-browser/', 'defaultStatus': 'unaffected'}, {'cpes': ['cpe:/o:redhat:enterprise_linux:8'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux 8', 'packageName': 'grafana', 'collectionURL': 'https://access.redhat.com/downloads/content/package-browser/', 'defaultStatus': 'unaffected'}, {'cpes': ['cpe:/o:redhat:enterprise_linux:8'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux 8', 'packageName': 'pcs', 'collectionURL': 'https://access.redhat.com/downloads/content/package-browser/', 'defaultStatus': 'unaffected'}, {'cpes': ['cpe:/o:redhat:enterprise_linux:9'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux 9', 'packageName': 'grafana', 'collectionURL': 'https://access.redhat.com/downloads/content/package-browser/', 'defaultStatus': 'unaffected'}, {'cpes': ['cpe:/o:redhat:enterprise_linux:9'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux 9', 'packageName': 'pcs', 'collectionURL': 'https://access.redhat.com/downloads/content/package-browser/', 'defaultStatus': 'unaffected'}, {'cpes': ['cpe:/a:redhat:enterprise_linux_ai:3'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux AI (RHEL AI) 3', 'packageName': 'rhelai3/bootc-cuda-rhel9', 'collectionURL': 'https://access.redhat.com/downloads/content/package-browser/', 'defaultStatus': 'unaffected'}, {'cpes': ['cpe:/a:redhat:enterprise_linux_ai:3'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux AI (RHEL AI) 3', 'packageName': 'rhelai3/disk-image-cuda-rhel9', 'collectionURL': 'https://access.redhat.com/downloads/content/package-browser/', 'defaultStatus': 'unaffected'}, {'cpes': ['cpe:/a:redhat:jboss_fuse:7'], 'vendor': 'Red Hat', 'product': 'Red Hat Fuse 7', 'packageName': 'io.syndesis-syndesis-parent', 'collectionURL': 'https://access.redhat.com/downloads/content/package-browser/', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/a:redhat:jboss_enterprise_application_platform:8'], 'vendor': 'Red Hat', 'product': 'Red Hat JBoss Enterprise Application Platform 8', 'packageName': 'org.keycloak-keycloak-parent', 'collectionURL': 'https://access.redhat.com/downloads/content/package-browser/', 'defaultStatus': 'unaffected'}, {'cpes': ['cpe:/a:redhat:jbosseapxp'], 'vendor': 'Red Hat', 'product': 'Red Hat JBoss Enterprise Application Platform Expansion Pack', 'packageName': 'org.keycloak-keycloak-parent', 'collectionURL': 'https://access.redhat.com/downloads/content/package-browser/', 'defaultStatus': 'unaffected'}, {'cpes': ['cpe:/a:redhat:openshift:4'], 'vendor': 'Red Hat', 'product': 'Red Hat OpenShift Container Platform 4', 'packageName': 'openshift4/ose-agent-installer-ui-rhel9', 'collectionURL': 'https://access.redhat.com/downloads/content/package-browser/', 'defaultStatus': 'unaffected'}, {'cpes': ['cpe:/a:redhat:openshift_distributed_tracing:3'], 'vendor': 'Red Hat', 'product': 'Red Hat OpenShift distributed tracing 3', 'packageName': 'rhosdt/tempo-jaeger-query-rhel8', 'collectionURL': 'https://access.redhat.com/downloads/content/package-browser/', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/a:redhat:red_hat_single_sign_on:7'], 'vendor': 'Red Hat', 'product': 'Red Hat Single Sign-On 7', 'packageName': 'org.keycloak-keycloak-parent', 'collectionURL': 'https://access.redhat.com/downloads/content/package-browser/', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/a:redhat:ansible_portal:2'], 'vendor': 'Red Hat', 'product': 'Self-service automation portal 2', 'packageName': 'ansible-automation-platform/automation-portal', 'collectionURL': 'https://access.redhat.com/downloads/content/package-browser/', 'defaultStatus': 'affected'}]

CVE Modified by 0b0ca135-0b70-47e7-9f44-1890c2a1c46c

Jul. 01, 2026

Action	Type	Old Value	New Value
Changed	Affected	[{'cpes': ['cpe:/a:redhat:ansible_automation_platform:2.5::el8', 'cpe:/a:redhat:ansible_automation_platform_developer:2.5::el8', 'cpe:/a:redhat:ansible_automation_platform_inside:2.5::el8'], 'vendor': 'Red Hat', 'product': 'Red Hat Ansible Automation Platform 2.5 for RHEL 8', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/a:redhat:ansible_automation_platform:2.5::el9', 'cpe:/a:redhat:ansible_automation_platform_developer:2.5::el9', 'cpe:/a:redhat:ansible_automation_platform_inside:2.5::el9'], 'vendor': 'Red Hat', 'product': 'Red Hat Ansible Automation Platform 2.5 for RHEL 9', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/a:redhat:ansible_automation_platform:2.6::el9', 'cpe:/a:redhat:ansible_automation_platform_developer:2.6::el9', 'cpe:/a:redhat:ansible_automation_platform_inside:2.6::el9'], 'vendor': 'Red Hat', 'product': 'Red Hat Ansible Automation Platform 2.6 for RHEL 9', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/a:redhat:ansible_automation_platform:2.6::el9'], 'vendor': 'Red Hat', 'product': 'Red Hat Ansible Automation Platform 2.6', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/a:redhat:rhdh:1.8::el9'], 'vendor': 'Red Hat', 'product': 'Red Hat Developer Hub 1.8', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/a:redhat:rhdh:1.9::el9'], 'vendor': 'Red Hat', 'product': 'Red Hat Developer Hub 1.9', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/a:redhat:openshift_devspaces:3.27::el9'], 'vendor': 'Red Hat', 'product': 'Red Hat OpenShift Dev Spaces 3.27', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/a:redhat:service_mesh:2.6::el8'], 'vendor': 'Red Hat', 'product': 'Red Hat OpenShift Service Mesh 2.6', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/a:redhat:quay:3.10::el8'], 'vendor': 'Red Hat', 'product': 'Red Hat Quay 3.1', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/a:redhat:trusted_artifact_signer:1.3::el9'], 'vendor': 'Red Hat', 'product': 'Red Hat Trusted Artifact Signer 1.3', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/a:redhat:openshift_pipelines:1'], 'vendor': 'Red Hat', 'product': 'OpenShift Pipelines', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/a:redhat:ansible_automation_platform:2'], 'vendor': 'Red Hat', 'product': 'Red Hat Ansible Automation Platform 2', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/a:redhat:podman_desktop:0'], 'vendor': 'Red Hat', 'product': 'Red Hat Build of Podman Desktop - Tech Preview', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/a:redhat:jboss_fuse:7'], 'vendor': 'Red Hat', 'product': 'Red Hat Fuse 7', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/a:redhat:openshift_distributed_tracing:3'], 'vendor': 'Red Hat', 'product': 'Red Hat OpenShift distributed tracing 3', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/a:redhat:red_hat_single_sign_on:7'], 'vendor': 'Red Hat', 'product': 'Red Hat Single Sign-On 7', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/a:redhat:ansible_portal:2'], 'vendor': 'Red Hat', 'product': 'Self-service automation portal 2', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/a:redhat:ansible_automation_platform:2.6::el10', 'cpe:/a:redhat:ansible_automation_platform_developer:2.6::el10'], 'vendor': 'Red Hat', 'product': 'Red Hat Ansible Automation Platform 2.6 for RHEL 10', 'defaultStatus': 'unaffected'}, {'cpes': ['cpe:/a:redhat:service_mesh:3'], 'vendor': 'Red Hat', 'product': 'OpenShift Service Mesh 3', 'defaultStatus': 'unaffected'}, {'cpes': ['cpe:/a:redhat:advanced_cluster_security:4'], 'vendor': 'Red Hat', 'product': 'Red Hat Advanced Cluster Security 4', 'defaultStatus': 'unaffected'}, {'cpes': ['cpe:/a:redhat:amq_broker:7'], 'vendor': 'Red Hat', 'product': 'Red Hat AMQ Broker 7', 'defaultStatus': 'unaffected'}, {'cpes': ['cpe:/a:redhat:optaplanner:::el6'], 'vendor': 'Red Hat', 'product': 'Red Hat build of OptaPlanner 8', 'defaultStatus': 'unaffected'}, {'cpes': ['cpe:/o:redhat:enterprise_linux:10'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux 10', 'defaultStatus': 'unaffected'}, {'cpes': ['cpe:/o:redhat:enterprise_linux:8'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux 8', 'defaultStatus': 'unaffected'}, {'cpes': ['cpe:/o:redhat:enterprise_linux:9'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux 9', 'defaultStatus': 'unaffected'}, {'cpes': ['cpe:/a:redhat:enterprise_linux_ai:3'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux AI (RHEL AI) 3', 'defaultStatus': 'unaffected'}, {'cpes': ['cpe:/a:redhat:jboss_enterprise_application_platform:8'], 'vendor': 'Red Hat', 'product': 'Red Hat JBoss Enterprise Application Platform 8', 'defaultStatus': 'unaffected'}, {'cpes': ['cpe:/a:redhat:jbosseapxp'], 'vendor': 'Red Hat', 'product': 'Red Hat JBoss Enterprise Application Platform Expansion Pack', 'defaultStatus': 'unaffected'}, {'cpes': ['cpe:/a:redhat:openshift:4'], 'vendor': 'Red Hat', 'product': 'Red Hat OpenShift Container Platform 4', 'defaultStatus': 'unaffected'}]	[{'cpes': ['cpe:/a:redhat:ansible_automation_platform:2.5::el8', 'cpe:/a:redhat:ansible_automation_platform_developer:2.5::el8', 'cpe:/a:redhat:ansible_automation_platform_inside:2.5::el8'], 'vendor': 'Red Hat', 'product': 'Red Hat Ansible Automation Platform 2.5 for RHEL 8', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/a:redhat:ansible_automation_platform:2.5::el9', 'cpe:/a:redhat:ansible_automation_platform_developer:2.5::el9', 'cpe:/a:redhat:ansible_automation_platform_inside:2.5::el9'], 'vendor': 'Red Hat', 'product': 'Red Hat Ansible Automation Platform 2.5 for RHEL 9', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/a:redhat:ansible_automation_platform:2.6::el9', 'cpe:/a:redhat:ansible_automation_platform_developer:2.6::el9', 'cpe:/a:redhat:ansible_automation_platform_inside:2.6::el9'], 'vendor': 'Red Hat', 'product': 'Red Hat Ansible Automation Platform 2.6 for RHEL 9', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/a:redhat:ansible_automation_platform:2.6::el9'], 'vendor': 'Red Hat', 'product': 'Red Hat Ansible Automation Platform 2.6', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/a:redhat:rhdh:1.8::el9'], 'vendor': 'Red Hat', 'product': 'Red Hat Developer Hub 1.8', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/a:redhat:rhdh:1.9::el9'], 'vendor': 'Red Hat', 'product': 'Red Hat Developer Hub 1.9', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/a:redhat:openshift_devspaces:3.27::el9'], 'vendor': 'Red Hat', 'product': 'Red Hat OpenShift Dev Spaces 3.27', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/a:redhat:service_mesh:2.6::el8'], 'vendor': 'Red Hat', 'product': 'Red Hat OpenShift Service Mesh 2.6', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/a:redhat:quay:3.10::el8'], 'vendor': 'Red Hat', 'product': 'Red Hat Quay 3.10', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/a:redhat:trusted_artifact_signer:1.3::el9'], 'vendor': 'Red Hat', 'product': 'Red Hat Trusted Artifact Signer 1.3', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/a:redhat:openshift_pipelines:1'], 'vendor': 'Red Hat', 'product': 'OpenShift Pipelines', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/a:redhat:ansible_automation_platform:2'], 'vendor': 'Red Hat', 'product': 'Red Hat Ansible Automation Platform 2', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/a:redhat:podman_desktop:0'], 'vendor': 'Red Hat', 'product': 'Red Hat Build of Podman Desktop - Tech Preview', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/a:redhat:jboss_fuse:7'], 'vendor': 'Red Hat', 'product': 'Red Hat Fuse 7', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/a:redhat:openshift_distributed_tracing:3'], 'vendor': 'Red Hat', 'product': 'Red Hat OpenShift distributed tracing 3', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/a:redhat:red_hat_single_sign_on:7'], 'vendor': 'Red Hat', 'product': 'Red Hat Single Sign-On 7', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/a:redhat:ansible_portal:2'], 'vendor': 'Red Hat', 'product': 'Self-service automation portal 2', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/a:redhat:ansible_automation_platform:2.6::el10', 'cpe:/a:redhat:ansible_automation_platform_developer:2.6::el10'], 'vendor': 'Red Hat', 'product': 'Red Hat Ansible Automation Platform 2.6 for RHEL 10', 'defaultStatus': 'unaffected'}, {'cpes': ['cpe:/a:redhat:service_mesh:3'], 'vendor': 'Red Hat', 'product': 'OpenShift Service Mesh 3', 'defaultStatus': 'unaffected'}, {'cpes': ['cpe:/a:redhat:advanced_cluster_security:4'], 'vendor': 'Red Hat', 'product': 'Red Hat Advanced Cluster Security 4', 'defaultStatus': 'unaffected'}, {'cpes': ['cpe:/a:redhat:amq_broker:7'], 'vendor': 'Red Hat', 'product': 'Red Hat AMQ Broker 7', 'defaultStatus': 'unaffected'}, {'cpes': ['cpe:/a:redhat:optaplanner:::el6'], 'vendor': 'Red Hat', 'product': 'Red Hat build of OptaPlanner 8', 'defaultStatus': 'unaffected'}, {'cpes': ['cpe:/o:redhat:enterprise_linux:10'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux 10', 'defaultStatus': 'unaffected'}, {'cpes': ['cpe:/o:redhat:enterprise_linux:8'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux 8', 'defaultStatus': 'unaffected'}, {'cpes': ['cpe:/o:redhat:enterprise_linux:9'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux 9', 'defaultStatus': 'unaffected'}, {'cpes': ['cpe:/a:redhat:enterprise_linux_ai:3'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux AI (RHEL AI) 3', 'defaultStatus': 'unaffected'}, {'cpes': ['cpe:/a:redhat:jboss_enterprise_application_platform:8'], 'vendor': 'Red Hat', 'product': 'Red Hat JBoss Enterprise Application Platform 8', 'defaultStatus': 'unaffected'}, {'cpes': ['cpe:/a:redhat:jbosseapxp'], 'vendor': 'Red Hat', 'product': 'Red Hat JBoss Enterprise Application Platform Expansion Pack', 'defaultStatus': 'unaffected'}, {'cpes': ['cpe:/a:redhat:openshift:4'], 'vendor': 'Red Hat', 'product': 'Red Hat OpenShift Container Platform 4', 'defaultStatus': 'unaffected'}]

CVE Modified by 0b0ca135-0b70-47e7-9f44-1890c2a1c46c

Jun. 30, 2026

Action	Type	New Value
Added	Affected	[{'cpes': ['cpe:/a:redhat:ansible_automation_platform:2.5::el8', 'cpe:/a:redhat:ansible_automation_platform_developer:2.5::el8', 'cpe:/a:redhat:ansible_automation_platform_inside:2.5::el8'], 'vendor': 'Red Hat', 'product': 'Red Hat Ansible Automation Platform 2.5 for RHEL 8', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/a:redhat:ansible_automation_platform:2.5::el9', 'cpe:/a:redhat:ansible_automation_platform_developer:2.5::el9', 'cpe:/a:redhat:ansible_automation_platform_inside:2.5::el9'], 'vendor': 'Red Hat', 'product': 'Red Hat Ansible Automation Platform 2.5 for RHEL 9', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/a:redhat:ansible_automation_platform:2.6::el9', 'cpe:/a:redhat:ansible_automation_platform_developer:2.6::el9', 'cpe:/a:redhat:ansible_automation_platform_inside:2.6::el9'], 'vendor': 'Red Hat', 'product': 'Red Hat Ansible Automation Platform 2.6 for RHEL 9', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/a:redhat:ansible_automation_platform:2.6::el9'], 'vendor': 'Red Hat', 'product': 'Red Hat Ansible Automation Platform 2.6', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/a:redhat:rhdh:1.8::el9'], 'vendor': 'Red Hat', 'product': 'Red Hat Developer Hub 1.8', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/a:redhat:rhdh:1.9::el9'], 'vendor': 'Red Hat', 'product': 'Red Hat Developer Hub 1.9', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/a:redhat:openshift_devspaces:3.27::el9'], 'vendor': 'Red Hat', 'product': 'Red Hat OpenShift Dev Spaces 3.27', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/a:redhat:service_mesh:2.6::el8'], 'vendor': 'Red Hat', 'product': 'Red Hat OpenShift Service Mesh 2.6', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/a:redhat:quay:3.10::el8'], 'vendor': 'Red Hat', 'product': 'Red Hat Quay 3.1', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/a:redhat:trusted_artifact_signer:1.3::el9'], 'vendor': 'Red Hat', 'product': 'Red Hat Trusted Artifact Signer 1.3', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/a:redhat:openshift_pipelines:1'], 'vendor': 'Red Hat', 'product': 'OpenShift Pipelines', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/a:redhat:ansible_automation_platform:2'], 'vendor': 'Red Hat', 'product': 'Red Hat Ansible Automation Platform 2', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/a:redhat:podman_desktop:0'], 'vendor': 'Red Hat', 'product': 'Red Hat Build of Podman Desktop - Tech Preview', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/a:redhat:jboss_fuse:7'], 'vendor': 'Red Hat', 'product': 'Red Hat Fuse 7', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/a:redhat:openshift_distributed_tracing:3'], 'vendor': 'Red Hat', 'product': 'Red Hat OpenShift distributed tracing 3', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/a:redhat:red_hat_single_sign_on:7'], 'vendor': 'Red Hat', 'product': 'Red Hat Single Sign-On 7', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/a:redhat:ansible_portal:2'], 'vendor': 'Red Hat', 'product': 'Self-service automation portal 2', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/a:redhat:ansible_automation_platform:2.6::el10', 'cpe:/a:redhat:ansible_automation_platform_developer:2.6::el10'], 'vendor': 'Red Hat', 'product': 'Red Hat Ansible Automation Platform 2.6 for RHEL 10', 'defaultStatus': 'unaffected'}, {'cpes': ['cpe:/a:redhat:service_mesh:3'], 'vendor': 'Red Hat', 'product': 'OpenShift Service Mesh 3', 'defaultStatus': 'unaffected'}, {'cpes': ['cpe:/a:redhat:advanced_cluster_security:4'], 'vendor': 'Red Hat', 'product': 'Red Hat Advanced Cluster Security 4', 'defaultStatus': 'unaffected'}, {'cpes': ['cpe:/a:redhat:amq_broker:7'], 'vendor': 'Red Hat', 'product': 'Red Hat AMQ Broker 7', 'defaultStatus': 'unaffected'}, {'cpes': ['cpe:/a:redhat:optaplanner:::el6'], 'vendor': 'Red Hat', 'product': 'Red Hat build of OptaPlanner 8', 'defaultStatus': 'unaffected'}, {'cpes': ['cpe:/o:redhat:enterprise_linux:10'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux 10', 'defaultStatus': 'unaffected'}, {'cpes': ['cpe:/o:redhat:enterprise_linux:8'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux 8', 'defaultStatus': 'unaffected'}, {'cpes': ['cpe:/o:redhat:enterprise_linux:9'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux 9', 'defaultStatus': 'unaffected'}, {'cpes': ['cpe:/a:redhat:enterprise_linux_ai:3'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux AI (RHEL AI) 3', 'defaultStatus': 'unaffected'}, {'cpes': ['cpe:/a:redhat:jboss_enterprise_application_platform:8'], 'vendor': 'Red Hat', 'product': 'Red Hat JBoss Enterprise Application Platform 8', 'defaultStatus': 'unaffected'}, {'cpes': ['cpe:/a:redhat:jbosseapxp'], 'vendor': 'Red Hat', 'product': 'Red Hat JBoss Enterprise Application Platform Expansion Pack', 'defaultStatus': 'unaffected'}, {'cpes': ['cpe:/a:redhat:openshift:4'], 'vendor': 'Red Hat', 'product': 'Red Hat OpenShift Container Platform 4', 'defaultStatus': 'unaffected'}]
Added	CVSS V3.1	AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Added	CWE	CWE-22
Added	Reference	https://access.redhat.com/errata/RHSA-2026:10175
Added	Reference	https://access.redhat.com/errata/RHSA-2026:13508
Added	Reference	https://access.redhat.com/errata/RHSA-2026:13512
Added	Reference	https://access.redhat.com/errata/RHSA-2026:13545
Added	Reference	https://access.redhat.com/errata/RHSA-2026:5132
Added	Reference	https://access.redhat.com/errata/RHSA-2026:5649
Added	Reference	https://access.redhat.com/errata/RHSA-2026:5665
Added	Reference	https://access.redhat.com/errata/RHSA-2026:6174
Added	Reference	https://access.redhat.com/errata/RHSA-2026:6802
Added	Reference	https://access.redhat.com/errata/RHSA-2026:8483
Added	Reference	https://access.redhat.com/security/cve/CVE-2026-27606
Added	Reference	https://bugzilla.redhat.com/show_bug.cgi?id=2442530
Added	Reference	https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-27606.json

CVE Modified by 134c704f-9b21-4f2e-91b3-4a467353bcc0

Jun. 17, 2026

Action	Type	Old Value	New Value
Added	SSVC		{'id': 'CVE-2026-27606', 'role': 'CISA Coordinator', 'options': [{'exploitation': 'poc'}, {'automatable': 'yes'}, {'technicalImpact': 'total'}], 'version': '2.0.3', 'timestamp': '2026-02-25T20:09:59.552224Z'}

CVE Modified by [email protected]

Jun. 17, 2026

Action	Type	Old Value	New Value
Added	Affected		[{'vendor': 'rollup', 'product': 'rollup', 'versions': [{'status': 'affected', 'version': '< 2.80.0'}, {'status': 'affected', 'version': '>= 3.0.0, < 3.30.0'}, {'status': 'affected', 'version': '>= 4.0.0, < 4.59.0'}]}]

Initial Analysis by [email protected]

Feb. 25, 2026

Action	Type	New Value
Added	CVSS V3.1	AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Added	CPE Configuration	OR cpe:2.3:a:rollupjs:rollup::::::node.js:: versions up to (excluding) 2.80.0 cpe:2.3:a:rollupjs:rollup::::::node.js:: versions from (including) 3.0.0 up to (excluding) 3.30.0 cpe:2.3:a:rollupjs:rollup::::::node.js:: versions from (including) 4.0.0 up to (excluding) 4.59.0
Added	Reference Type	GitHub, Inc.: https://github.com/rollup/rollup/commit/c60770d7aaf750e512c1b2774989ea4596e660b2 Types: Patch
Added	Reference Type	GitHub, Inc.: https://github.com/rollup/rollup/commit/c8cf1f9c48c516285758c1e11f08a54f304fd44e Types: Patch
Added	Reference Type	GitHub, Inc.: https://github.com/rollup/rollup/commit/d6dee5e99bb82aac0bee1df4ab9efbde455452c3 Types: Patch
Added	Reference Type	GitHub, Inc.: https://github.com/rollup/rollup/releases/tag/v2.80.0 Types: Product
Added	Reference Type	GitHub, Inc.: https://github.com/rollup/rollup/releases/tag/v3.30.0 Types: Product
Added	Reference Type	GitHub, Inc.: https://github.com/rollup/rollup/releases/tag/v4.59.0 Types: Product
Added	Reference Type	GitHub, Inc.: https://github.com/rollup/rollup/security/advisories/GHSA-mw96-cpmx-2vgc Types: Exploit, Vendor Advisory

New CVE Received by [email protected]

Feb. 25, 2026

Action	Type	New Value
Added	Description	Rollup is a module bundler for JavaScript. Versions prior to 2.80.0, 3.30.0, and 4.59.0 of the Rollup module bundler (specifically v4.x and present in current source) is vulnerable to an Arbitrary File Write via Path Traversal. Insecure file name sanitization in the core engine allows an attacker to control output filenames (e.g., via CLI named inputs, manual chunk aliases, or malicious plugins) and use traversal sequences (`../`) to overwrite files anywhere on the host filesystem that the build process has permissions for. This can lead to persistent Remote Code Execution (RCE) by overwriting critical system or user configuration files. Versions 2.80.0, 3.30.0, and 4.59.0 contain a patch for the issue.
Added	CVSS V4.0	AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Added	CWE	CWE-22
Added	Reference	https://github.com/rollup/rollup/commit/c60770d7aaf750e512c1b2774989ea4596e660b2
Added	Reference	https://github.com/rollup/rollup/commit/c8cf1f9c48c516285758c1e11f08a54f304fd44e
Added	Reference	https://github.com/rollup/rollup/commit/d6dee5e99bb82aac0bee1df4ab9efbde455452c3
Added	Reference	https://github.com/rollup/rollup/releases/tag/v2.80.0
Added	Reference	https://github.com/rollup/rollup/releases/tag/v3.30.0
Added	Reference	https://github.com/rollup/rollup/releases/tag/v4.59.0
Added	Reference	https://github.com/rollup/rollup/security/advisories/GHSA-mw96-cpmx-2vgc

EPSS is a daily estimate of the probability of exploitation activity being observed over the next 30 days. Following chart shows the EPSS score history of the vulnerability.

CVE-2026-27606

Rollup 4 has Arbitrary File Write via Path Traversal

Description

INFO

Feb. 25, 2026, 3:16 a.m.

July 15, 2026, 2:19 a.m.

Yes !

[email protected]

Affected Products

CVSS Scores

Solution

Public PoC/Exploit Available at Github

References to Advisories, Solutions, and Tools

CWE - Common Weakness Enumeration

Common Attack Pattern Enumeration and Classification (CAPEC)

radeksh/vuln-today-jenkins-slack-lib

rmutyaba/cloudbeaver

Rgraf228/Security-writeups

th3oleano/cloudbeaver

hermanjustino/stems

NoTKanye23/attack-of-clones-research1

Lev0n82/SecurePlaywrightMCP

able-wong/docx-markdown-utils

huchukato/stemify-audio-splitter

dbeaver/cloudbeaver

CVE Modified by 0b0ca135-0b70-47e7-9f44-1890c2a1c46c

CVE Modified by 0b0ca135-0b70-47e7-9f44-1890c2a1c46c

CVE Modified by 0b0ca135-0b70-47e7-9f44-1890c2a1c46c

CVE Modified by 134c704f-9b21-4f2e-91b3-4a467353bcc0

CVE Modified by [email protected]

Initial Analysis by [email protected]

New CVE Received by [email protected]

Vulnerability Scoring Details

Base CVSS Score: 8.8

Base CVSS Score: 9.8

Browse by Apps

CVE-2026-27606

Rollup 4 has Arbitrary File Write via Path Traversal

Description

INFO

Feb. 25, 2026, 3:16 a.m.

July 15, 2026, 2:19 a.m.

Yes !

Affected Products

CVSS Scores

Solution

Public PoC/Exploit Available at Github

References to Advisories, Solutions, and Tools

CWE - Common Weakness Enumeration

Common Attack Pattern Enumeration and Classification (CAPEC)

CVE Modified by 0b0ca135-0b70-47e7-9f44-1890c2a1c46c

CVE Modified by 0b0ca135-0b70-47e7-9f44-1890c2a1c46c

CVE Modified by 0b0ca135-0b70-47e7-9f44-1890c2a1c46c

CVE Modified by 134c704f-9b21-4f2e-91b3-4a467353bcc0

CVE Modified by [email protected]

Initial Analysis by [email protected]

New CVE Received by [email protected]

Vulnerability Scoring Details

Base CVSS Score: 8.8

Base CVSS Score: 9.8

Cookie Preferences